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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions and listings of claims in the 
application: 

1 . (Currently Amended) A method for addressing packets in a firewall cluster 
within a single network, the firewall cluster including a plurality of firewall nodes, the 
method comprising: 

selectinc . from the firewall cluster within the sincle network, one of the 
firewall nodes within tho sing l e network for processing a first packet; 

receiving, at a first processor associated with the selected firewall node, 
the first packet; 

dotorm i ning modifvino . by the first processor, as a function of a 
multidimensional space for representing addresses processed by a set of data 
processors, a first address for the first packet into a second address for the first, packet, 
the second address beino within a ranoe of addresses assioned onlv to the selected 
firewall node : and 

fonwarding the first packet based on the dotorm i nod f i rst second address. 

2. (Original) The method of claim 1 , further comprising: 
using an N-tuple space as the multidimensional space. 

3. (Original) The method of claim 2, further comprising: 

assigning to the first processor a first region based on the N-tuple space. 
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4. (Original) The method of claim 3, further comprising: 

using the first address, such that the first address represents a point within 
the first region. 

5. (Original) The method of claim 4, further comprising: 

using N address values as the N-tupie, such that the N address values 
represent the point. 

6. (Original) The method of claim 2, further comprising: 

using the N-tuple space, such that N is equal to a value of at least two. 

7. (Original) The method of claim 3, further comprising: 

assigning to a second processor a second region based on the N-tuple 
space, such that the first region is separate from the second region. 

8. (Currently Amended) The method of claim 7, further comprising: 
forwarding, at the second processor, a second packet with a the second 

address determined based on the second region, such that the second packet does not 
conflict with the first packet. 

9. (Currently Amended) The method of claim 7, further comprising: 
forwarding, at the second processor, a second packet with a the second 

address determined based on the second region, such that the second address does 
not conflict with the first address. 
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10. (Currently Amended) A method for addressing packets associated with a 
plurality of processors, each processor being associated with one of a plurality of 
firewall nodes in a firewall cluster within a single network, the method comprising: 

selectin o. from the firewall cluster within the sinole network, one of the 
firewall node s within tho s i ng l o network for processing a packet, the selected firewall 
node including a first processor; 

receiving, at the first processor, the packet; 

reading, at the first processor, an N-tuple address of the received packet; 

determining, by the first processor, whether the N-tuple address is within 
an N-tuple space assigned to the first processor; 

sending the packet with the N-tuple address, when it is determined that 
the N-tuple address is within the N-tuple space assigned to the first processor; and 

determining a modified N-tuple address, when it is determined that the 
N-tuple address Is not within the N-tuple space assigned to the first processor and 
sending the packet with based on the modified N-tuple address. 

1 1 . (Original) The method of claim 1 0, wherein the reading step further 
comprises: 

reading as the N-tuple address, a plurality of values from the received 

packet. . 

12. (Original) The method of claim 1 1 , wherein the reading step further 
comprises: 
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reading at least a source port. 

13. (Original) The method of claim 10, wherein the step of determining 
whether the N-tuple address Is within the N-tuple space, further comprises: 

determining whether the N-tuple address is within the N-tuple space 
based on a comparison between the N-tuple address of the packet and the N-tuple 
space assigned to the first processor. 

14. (Original) The method of claim 1 0, wherein the step of determining 
whether the N-tuple address is within the N-tuple space, further comprises: 

determining whether the N-tuple address of the packet is within the 
N-tuple space based a quadrant identifier value, wherein the quadrant identifier value 
corresponds to the first processor. 

15. (Original) The method of claim 14, wherein the step of determining 
whether the N-tuple address of the packet is within the N-tuple space, further 
comprises: 

determining the quadrant identifier value based on a hash function. 

16. (Original) The method of claim 14, wherein the step of determining 
whether the N-tuple address of the packet Is within the N-tuple space, further 
comprises: 

determining the quadrant identifier value based on a hash function and a 
modulo division. 
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17. (Original) The method of claim 10, wherein the step of determining the 
modified N-tuple further comprises: 

adding a value to the N-tuple address, such that the modified N-tuple 
address is within the N-tuple space assigned to the first processor. 

1 8. (Original) The method of claim 14, wherein the step of determining the 
modified N-tuple address further comprises: 

modifying the N-tuple address based on the quadrant identifier value. 

1 9. (Original) The method of claim 10, wherein the step of sending the packet 
with the N-tuple address, further comprises: 

sending the packet with the N-tuple address, such that the packet does 
not conflict with another N-tuple address associated with a second one of the 
processors. 

20. (Cancelled). 



21 . (Original) The method of claim 10, further comprising: 
using a computer as the first processor. 

22. (Original) The method of claim 10, further comprising: 
using a router as the first processor. 

23. (Cancelled). 
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24. (Currently Amended) A method of addressing pacl<ets in a firewall cluster 
within a singe network, wherein the firewall cluster comprises a set of processors, each 
processor being associated with a firewall node, the method comprising: 

selectinc . from the firewall cluster within the single network, one of the 
firewall nodes within tho eing l o network for processing a packet, the selected firewall 
node including a first processor; 

receiving, at the first processor, the packet; 

reading, at the first processor, an N-tuple address of the received packet; 

determining a quadrant identifier based on the read N-tuple address, a 
hash function, and modulo division; 

determining whether the read N-tuple address corresponds to the first 
processor based on the quadrant identifier; 

sending the packet with the N-tuple address, when the quadrant identifier 
corresponds to the first processor; and 

determining a modified N-tuple address, when the quadrant identifier does 
not corresponds correspond to the first processor and sending the packet witl=> based on 
the modified N-tuple address. 

25. (Original) The method of claim 24, further comprising: 
assigning each of the set of processors a firewall node number. 

26. (Original) The method of claim 25, further comprising: 
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determining whether the N-tuple address corresponds to the first 
processor based on the quadrant Identifier and the firewall node number. 

27. (Currently Amended) A system for addressing packets in a firewall cluster 
within a single network, the firewall cluster including a plurality of firewall nodes, the 
system comprising: 

means for selectino . from the firewall cluster within the sinole network, one 
of the firewall nodes i n tho sing l e network for processing a first packet; 

means for receiving, at a first processor associated with the selected 
firewall node, the first packet; 

means for dotormining modifying as a function of a multidimensional 
space for representing addresses processed by a set of data processors, a first address 
for the first packet Into a second address for the first packet, the second address being 
within a range of addresses assigned only to the selected firewall node : and 

means for fonwarding the first packet based on the dotorminod f i rst second 

address. 

28. (Currently Amended) A system for addressing packets associated with 
one or more processors, each processor being associated with a firewall node in a 
firewall cluster within a single network, the system comprising: 

means for selecting , from the firewall cluster within the single network, one 
of the firewall nodes w i th i n tho sing l e network for processing a packet, the selected 
firewall node including a first processor; 
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nneans for receiving, at tlie first processor, the pacl<et; 
means for reading, at the first processor, an N-tuple address of the 
received packet; 

means for determining whether the N-tuple address is within an N-tuple 
space assigned to the first processor; 

means for sending the packet with the N-tuple address, when it is 
determined that the N-tuple address is within the N-tuple space assigned to the first 
processor; and 

means for determining a modified N-tuple address, when it is determined 
that the N-tuple address is not within the N-tuple space assigned to the first processor 
and sending the packet with based on the modified N-tuple address. 

29. (Currently Amended) A firewall cluster within a single network including 
one or more firewall nodes associated with one or more processors, comprising: 

means for selecting , from the firewall cluster within the sincle network. 
one of the firewall nodes with i n tho cinglo network for processing a packet, the selected 
firewall node including a first processor; 

means for receiving, at the first processor, the packet; 

means for reading, at the first processor, an N-tuple address of the 
received packet; 

means for determining a quadrant identifier based on the read N-tuple 
address, a hash function, and modulo division; 
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means for determining whether the read N-tuple address corresponds to 
the first processor based on the quadrant identifier; 

means for sending the pacl<et with the N-tuple address, when the 
quadrant identifier corresponds to the first processor; and 

means for determining a modified N-tuple address, when the quadrant 
identifier does not corresponds to the first processor and sending the packet witt^ based 
on the modified N-tuple address. 

30. (Currently Amended) A system including a firewall cluster within a single 
network including a plurality of firewall nodes, the firewall nodes being associated with 
one or more processors, said system comprising: 
at least one memory comprising: 

code that selects , from the firewall cluster within the sincle network. 
one of the firewall nodes w i thin tho sing l o network for processing a first packet, 
the selected firewall node including a first processor; 

code that receives, at the first processor, the first packet; 
code that determines modifies, as a function of a multidimensional 
space for representing addresses processed by a set of data processors, a first 
address for the first packet into a second address for the first packet, the second 
address beinc within a range of addresses assioned only to the selected firewall 
node : and 

code that fon^/ards the first packet based on the dotorm i nod first 
second address; and 
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at least one processor for executing the code. 

31 . (Currently Amended) A system Including a firewall cluster within a single 
network including a plurality of firewall nodes, the firewall nodes being associated with 
one or more processors, the system comprising: 
at least one memory comprising: 

code that select s, from the firewall cluster within the single network. 
one of the firewall nodes with i n tho s i ng l e network for processing a packet, the 
selected firewall node including a first processor; 

code that receives, at the first processor, the packet; 
code that reads, at the first processor, an N-tuple address of the 
received packet; 

code that determines whether the N-tuple address is within an N- 
tuple space assigned to the first processor; 

code that sends the packet with the N-tuple address, when it is 
determined that the N-tuple address is within the N-tuple space assigned to the 
first processor; and 

code that determines a modified N-tuple address, when it is 
determined that the N-tuple address is not within the N-tuple space assigned to 
the first processor and sending the packet with based on the modified N-tuple 
address; and 

at least one processor for executing the code. 
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32. (Original) Tlie system of claim 31 , wherein code that reads further 
comprises: 

code that reads as the N-tuple address, a plurality of values from the 
received packet. 

33. (Original) The system of claim 32, wherein code that reads the plurality of 
values further comprises: 

code that reads at least a source port. 

34. (Original) The system of claim 31 , wherein code that determines whether 
the N-tuple address is within the N-tuple space, further comprises: 

code that determines whether the N-tuple address is within the N-tuple 
space based a comparison between the N-tuple address of the packet and the N-tuple 
space assigned to the first processor. 

35. (Original) The system of claim 31 , wherein code that determines whether 
the N-tuple address is within the N-tuple space, further comprises: 

code that determines whether the N-tuple address of the packet is within 
the N-tuple space based a quadrant identifier value, wherein the quadrant identifier 
corresponds to the first processor. 

36. (Original) The system of claim 35 wherein code that determines whether 
the N-tuple address of the packet is within the N-tuple space, further comprises: 
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code that determines tlie quadrant identifier value based on a hash 

function. 

37. (Currently Amended) A firewall cluster including a plurality of firewall 
nodes within a single network, the firewall nodes being associated with one or more 
processors, the firewall cluster comprising: 

at least one memory comprising 

code that selects , from the firewall cluster within the single network. 
one of the firewall nodes w i thin tho eing l o network for processing a packet, the 
selected firewall node including a first processor; 

code that receives, at the first processor, the packet; 

code that reads, at the first processor, an N-tuple address of the 
received packet; 

code that determines a quadrant identifier based on the read 
N-tuple address, a hash function, and modulo division; 

code that determines whether the read N-tuple address 
corresponds to the first processor based on the quadrant identifier; 

code that sends the packet with the N-tuple address, when the 
quadrant identifier corresponds to the first processor; and 

code that determines a modified N-tuple address, when the 
quadrant identifier does not corresponds to the first processor and sends the 
packet wtth based on the modified N-tuple address; and 
at least one processor for executing the code. 
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38. (Currently Amended) A computer-readable storage medium comprising 
instructions which, when executed by a processor, perform a method for addressino 
packets in a firewall cluster within a single network, the firewall cluster including a 
plurality of firewall nodes, the method including: 

selecting on e, from the firewall cluster within the single network, of the 
firewall nodes with i n tho c i nglo notwork for processing a packet, the selected firewall 
node being associated with a first processor; 

receiving, at the first processor, the packet; 

reading, at the first processor, an N-tuple address of the received packet; 

determining whether the N-tuple address is within an N-tuple space 
assigned to the first processor; 

sending the packet with the N-tuple address, when it is determined that 
the N-tuple address is within the N-tuple space assigned to the first processor; and 

determining a modified N-tuple address, when it Is determined that the 
N-tuple address is not within the N-tuple space assigned to the first processor and 
sending the packet wltl^ based on the modified N-tuple address. 

39. (Currently Amended) The computer-readable storage medium of claim 
38, wherein reading further comprises: 

reading as the N-tuple address, a plurality of values from the received 

packet. 
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40. (Currently Amended) The computer-readable storage medium of claim 
39, wherein reading the plurality of values further comprises: 

reading at least a source port. 

41 . (Currently Amended) The computer-readable storage medium of claim 
39, wherein determining whether the N-tuple address is within the N-tuple space, further 
comprises: 

determining whether the N-tuple address is within the N-tuple space 
based a comparison between the N-tuple address of the packet and the N-tuple space 
assigned to the first processor. 

42. (Currently Amended) The computer-readable storage medium of claim 
39, wherein determining whether the N-tuple address Is within the N-tuple space, further 
comprises: 

determining whether the N-tuple address of the packet is within the N- 
tuple space based a quadrant identifier value, wherein the quadrant identifier value 
corresponds to the first processor. 

43. (Currently Amended) The computer-readable storage medium of claim 
42, wherein determining whether the N-tuple address of the packet is within the N-tuple 
space, further comprises: 

determining the quadrant identifier value based on a hash function. 
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44. (Currently Amended) A computer-readable storage medium comprising 
instructions which, when executed by a processor, perform a method for addressing 
packets in a firewall cluster within a single network, the firewall cluster including a 
plurality of firewall nodes, the method including: 

selecting , from the firewall cluster within the single network, one of the 
firewall nodes w i thin tho cing l o network for processing a packet, the selected firewall 
node including a first processor; 

receiving, at the first processor, the packet; 

reading, at the first processor, an N-tuple address of the received packet; 

determining a quadrant identifier based on the read N-tuple address, a 
hash function, and modulo division; 

determining whether the read N-tuple address corresponds to the first 
processor based on the quadrant identifier; 

sending the packet with the N-tupie address, when the quadrant identifier 
corresponds to the first processor; and 

determining a modified N-tuple address, when the quadrant identifier does 
not corresponds to the first processor and sending the packet with based on the 
modified N-tuple address. 

45. (Currently Amended) A computer-readable storage medium comprising 
instructions which, when executed by a processor, perform a method for addressing 
packets in a firewall cluster within a single network, the firewall cluster including a 
plurality of firewall nodes, the method including: 
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selectin g, from the firewall cluster within the single network, one of the 
firewall nodes within the single network for processing a first packet, the selected 
firewall node being associated with a first processor; 

receiving, at the first processor, the first packet; 

dotorm i ning modifying, as a function of a multidimensional space for 
representing addresses processed by a set of data processors, a first address for the 
first packet into a second address for the first packet, the second address being within a 
range of addresses assigned only to the selected firewall node : and 

fonvarding the first packet based on the dotorminod f i rst second address. 
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